DNS is a good start. You'll be missing some but not much.
Do you mean brute-force trail and error for every possible domain? That looks daunting, and an easy way to have your IP address blocked.
Verisign com zone file, available for free upon request
We needed to fax a form to them though. Travelling to the nineties was the hardest part of setting it up.
Anyone know where you can download this without sending a fax?
They want the fax likely because it's legally binding.
They also want to ensure that it's clear they are the authoritative source for those zones - so no sharing what you download.
If you want it on any regular basis.. send the fax :)
E-signatures are legally binding. Likely they want the fax to discourage anyone who actually wants the list from obtaining it.